Zloader With a New Infection Technique

This McAfee Labs analysis details a Zloader infection chain: phishing emails deliver a malicious Word document which downloads a password-protected Excel file; the Word VBA reads cell contents and writes macros into the Excel file, modifies registry settings to disable Excel macro warnings, and triggers an Auto_Open macro that downloads a Zloader DLL (.cpl) and executes it via rundll32. The report includes IOCs (SHA-256 hashes and download URLs), detection signatures, mitigation advice, and mappings to relevant MITRE ATT&CK techniques.